evmbulksender[.]com

Analysis of evmbulksender.com shows a newly registered domain created on February 21, 2026 that has been used for wallet or seed phishing. The site resolves to IP address 104.21.89.148, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No SSL certificate was observed, indicating the site operated without HTTPS. The registrar listed is Hello Internet Corp, and the domain is served by the nameservers ns100.webnic.cc and ns101.webnic.cc.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, while Scamadviser reports a score of 20 out of 100, both reflecting a highly malicious posture. The domain appears on four external security blocklists and is explicitly blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, confirming its classification as a phishing vector. AlienVault OTX has indexed the domain in one threat‑intel pulse, and VirusTotal scans indicate that two of ninety‑three security vendors flagged the site as malicious. The page title retrieved, "EVMbulkSender.com – Multi-chain EVM-based Bulk Sender | FAQ," aligns with the advertised service and supports the wallet/seed phishing claim.

Current status is offline, suggesting the active hosting has been taken down, but the infrastructure footprint (Cloudflare IP, known blocklists) remains a reusable asset for potential re‑deployment. Defenders should continue to monitor the domain’s DNS resolution for any re‑activation, ensure it is added to internal blocklists, and correlate any outbound traffic to the listed IP with credential‑theft detection rules. Given the low trust scores, multiple blocklist listings, and confirmed vendor detections, the domain should be treated as a high‑confidence malicious indicator and excluded from any trusted web‑access policies.